Collecting NRIC numbers by organisations to be made illegal from 1 Sept 2019

From 1 September 2019, organisations will not be allowed to collect national registration identity card (NRIC) numbers or make copies of NRICs, according to new guidelines by the Personal Data Protection Commission (PDPC) released on Friday (31 August).

An NRIC number can be potentially be used to unlock large amounts of personal information, and the collection and disclosure of the number is of special concern, according to the PDPC guidelines.

“In today’s Digital Economy, indiscriminate collection or negligent handling of NRIC numbers can increase the risk of unintended disclosure and may result in NRIC numbers being used for illegal activities such as identity theft or fraud,” the PDPC said in a media release.

The same restrictions extend to Birth Certificate numbers, foreign identity numbers and work permit numbers.

Organisations will only be allowed to ask for NRIC numbers if required by the law or if necessary to prove one’s identity, the PDPC said.

There are exceptions to the new guidelines including joining an organisation as a new employee, checking into a hotel, seeking medical treatment, or subscribing for a mobile phone line. The guidelines also do not apply to the use of NRIC numbers or retention of physical NRICs by a public agency or an organisation appointed by a public agency.

The agency also gave examples of cases of when not to give out NRIC numbers: redeeming free parking, signing up for retail membership, submitting feedback, buying movie tickets online, or participating in a lucky draw.